Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/07/2024, 23:53

General

  • Target

    SKlauncher-3.2.exe

  • Size

    1.6MB

  • MD5

    b63468dd118dfbca5ef7967ba344e0e3

  • SHA1

    2ba4f0df5f3bd284bf2a89aba320e4440d8b8355

  • SHA256

    05ae2f0dd61ef10019b94c200e8df192b767bb4cc24a7e7b329ab43cc9c74caf

  • SHA512

    007ecb7445dc0c01a802b5a2c91313aae59f9dc96e27455dd85e7a92a4e649d683fbc2ada5f48925d9ab3b4fdaea20aa89eeb442fde079902aecb5ca3454a548

  • SSDEEP

    49152:HIBc3n9dRvwVlzhFAQ/ggUTPQjYEiim7V:oBaO/FAqMQjYEXm

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe
    "C:\Users\Admin\AppData\Local\Temp\SKlauncher-3.2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4648
    • \??\c:\PROGRA~1\java\jre-1.8\bin\java.exe
      "c:\PROGRA~1\java\jre-1.8\bin\java.exe" -version
      2⤵
        PID:2460
      • \??\c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe
        "c:\PROGRA~1\java\jdk-1.8\jre\bin\java.exe" -version
        2⤵
          PID:2560
        • C:\Windows\SYSTEM32\reg.exe
          reg query "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v AppsUseLightTheme
          2⤵
            PID:2320

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

          Filesize

          46B

          MD5

          3e63f774b259d2e28c41611afd2208fe

          SHA1

          dd7a195e52614734cde9db8515a216d24b1e46b4

          SHA256

          b6ebfee96d709b41b1adb5a8ac41ca382e9a54a879340ff2aa4d8fa08ab72938

          SHA512

          66f403d3239a2676a40a8930f9e37a32aa984bed6c641eb89d0821da46975be5dce6c1f1025e114546e9c3865742b88ac04151d006c79d2457c5fe907910eb62

        • C:\Users\Admin\AppData\Local\Temp\+JXF5962253368711146687.tmp

          Filesize

          398KB

          MD5

          ff5fdc6f42c720a3ebd7b60f6d605888

          SHA1

          460c18ddf24846e3d8792d440fd9a750503aef1b

          SHA256

          1936d24cb0f4ce7006e08c6ef4243d2e42a7b45f2249f8fe54d92f76a317dfd1

          SHA512

          d3d333b1627d597c83a321a3daca38df63ea0f7cab716006935905b8170379ec2aab26cb7ffc7b539ca272cf7fb7937198aee6db3411077bedf3d2b920d078a3

        • C:\Users\Admin\AppData\Local\Temp\+JXF7194679093845592221.tmp

          Filesize

          405KB

          MD5

          8f2869a84ad71f156a17bb66611ebe22

          SHA1

          0325b9b3992fa2fdc9c715730a33135696c68a39

          SHA256

          0cb1bc1335372d9e3a0cf6f5311c7cce87af90d2a777fdeec18be605a2a70bc1

          SHA512

          3d4315d591dcf7609c15b3e32bcc234659fcdbe4be24aef5dba4ad248ad42fd9ab082250244f99dc801ec21575b7400aace50a1e8834d5c33404e76a0caac834

        • C:\Users\Admin\AppData\Local\Temp\+JXF8670673271358078417.tmp

          Filesize

          397KB

          MD5

          fdb50e0d48cdcf775fa1ac0dc3c33bd4

          SHA1

          5c95e5d66572aeca303512ba41a8dde0cea92c80

          SHA256

          64f8be6e55c37e32ef03da99714bf3aa58b8f2099bfe4f759a7578e3b8291123

          SHA512

          20ce8100c96058d4e64a12d0817b7ce638cec9f5d03651320eb6b9c3f47ee289ccc695bd3b5b6bf8e0867cdab0ebb6e8cae77df054e185828a6a13f3733ede53

        • C:\Users\Admin\AppData\Local\Temp\e4j8349.tmp_dir1720569270\SKlauncher-3.2.jar

          Filesize

          1.1MB

          MD5

          4d653e61ba01a521c56b9a70a9c9814e

          SHA1

          de855dc3dbc914b497b58da92e0c21fff660796d

          SHA256

          f7d3e01dcfc001cc80a988c518d4358955842d140054214d1367972c5c543350

          SHA512

          e6a7db6e2893b5b01dd0c84a230d88abf50da63ceb1af5754a2c4c1fbd307a799a74f3f368430d3beb33590cda2e0a3cf509fef11c4477b76e8d3c4a582b5def

        • C:\Users\Admin\AppData\Local\Temp\flatlaf.temp\flatlaf-windows-x86_64-4730279264900.dll

          Filesize

          22KB

          MD5

          dcd68a87b7e6edbcfde48150403b22eb

          SHA1

          28e4839a29725075772fccc39b44e194eb91e477

          SHA256

          ae3352b6ad6cffaae55f4387f9f5e79365ea17f8d5fb45ef11d21c3300a49a4c

          SHA512

          ac2a6bc0afcd08c56090536a937772edd54f35505c9a5837d9bc8e91c31edb6137cf5191986b3473e9e2f512950b4dbfe4088598bfd1faf47088124c70aeba71

        • C:\Users\Admin\AppData\Roaming\.minecraft\sklauncher-fx.jar

          Filesize

          14.1MB

          MD5

          7e3ed7694833d8cfb47a47cfc9d4205c

          SHA1

          7d3699db91e0569903bd902b54acc8d2f373e02a

          SHA256

          99dd19398f87d030fa39c56ca0a5a0284db37128d1623bd1edb0de66f9861290

          SHA512

          ceeef6d0194438af9ff4256305204ab43bb3d50db372716bca8754dc91fdcfe15109d900fb41da20b53853b16a088c5f2a26d54331b8744d3886ab1939883460

        • memory/2460-16-0x0000021D948E0000-0x0000021D94B50000-memory.dmp

          Filesize

          2.4MB

        • memory/2460-15-0x0000021D93090000-0x0000021D93091000-memory.dmp

          Filesize

          4KB

        • memory/2460-5-0x0000021D948E0000-0x0000021D94B50000-memory.dmp

          Filesize

          2.4MB

        • memory/2560-30-0x000001CAEC6C0000-0x000001CAEC930000-memory.dmp

          Filesize

          2.4MB

        • memory/2560-29-0x000001CAEAE00000-0x000001CAEAE01000-memory.dmp

          Filesize

          4KB

        • memory/2560-19-0x000001CAEC6C0000-0x000001CAEC930000-memory.dmp

          Filesize

          2.4MB

        • memory/4648-176-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-275-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-174-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-122-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-177-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-215-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-224-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-82-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-273-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-128-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-274-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-278-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-283-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-281-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-286-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-287-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-49-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-45-0x0000000002340000-0x0000000002341000-memory.dmp

          Filesize

          4KB

        • memory/4648-33-0x00000000025C0000-0x0000000002830000-memory.dmp

          Filesize

          2.4MB

        • memory/4648-765-0x00000000025C0000-0x0000000002830000-memory.dmp

          Filesize

          2.4MB